Align CI, documentation, and final artifact evidence

[ericjuta]

Part of #11

Goal

Finish the migration only after implementation contracts are stable, then prove the repository and generated evidence agree with the destination and the current OpenAI host baseline.

Work

• Update fork-safe CI to install Bun 1.4 and a pinned Node 24 release for mandatory public-package smoke without adding write permissions, secrets, OIDC, release jobs, or remote cache.
• Align README, architecture, contribution, security, programmatic-client, package, CLI, eval, plugin, and issue-tracked distribution documentation with the actual ESM, runtime, export, and artifact contracts.
• Preserve docs/research-openai-plugin-compliance.md as research provenance. Do not reinterpret it as authorization to submit, publish, deploy, or perform portal/runtime-only actions.
• Preserve the canonical OpenAI manifest, support URL, skill agent metadata, and exact target-conformance checks added by baseline f10b5d1.
• Refresh only contract-bound eval receipts or fixtures whose source/catalog identity changed. Regenerate them after source, manifests, packer, and verifier are final.
• Keep canonical skills and host targets unchanged unless verification proves a required generated update.
• Run the full repository quality, test, target-conformance, artifact, verification, public-boundary, and Node 24 clean-consumer gates from a clean checkout.
• Record exact artifact file lists and command evidence. Do not claim publication or deployment.

Acceptance

• CI exercises the same locked Bun and Node contracts as local verification and remains fork-safe.
• Documentation neither advertises raw TypeScript, CommonJS, browser/edge support, public subpaths, nor publication.
• OpenAI research, manifest identity, support URL, per-skill interface metadata, and host outputs remain aligned with f10b5d1 unless an explicit ticket documents a necessary change.
• Generated fixture changes are minimal, sanitized, and tied to changed contract identities.
• All five package archives, five host archives, skills candidate, and bounded receipts pass the complete clean-checkout gate.
• No generated dist output is committed.

Non-goals

No package publish, tag, release, deployment, skill installation, OpenAI portal action, dependency upgrade, unrelated research rewrite, or unrelated fixture refresh.

[ericjuta]

Resolved on refactor/esm with final artifact and eval repairs through d1da634.
Pull request: #27

Implementation:

• Fork-safe CI now pins Bun 1.4.0 and Node 24.7.0 under read-only repository permissions, then exercises target conformance, artifact assembly, clean verification, clean package installation, and the public-boundary scan.
• Repository, architecture, contribution, security, programmatic-client, package, CLI, eval, and plugin documentation now describe the actual compiled ESM, runtime, export, artifact, and non-publication contracts.
• Canonical OpenAI authoring metadata and research provenance were not changed. Target-conformance and artifact verification reproduce and check the existing support URL, manifest identity, and all per-skill interface metadata.
• No contract-bound eval fixture required regeneration; generated dist/ remains ignored evidence.
• The final reviewer repair strips declaration-map trailers that Vite+ emitted without declaration maps, rejects any future declaration that references an omitted map, and scans every shipped source-map format at the public boundary.
• Artifact assembly rebuilds the five packages inside the immutable source-commit snapshot with the pinned Node 24 runtime, byte-compares ignored live output, and stages only snapshot-built bytes; modified ignored executable bytes are rejected before package staging.
• Root eval commands now build the package graph before launching compiled binaries, so hermetic and live evals work from a clean checkout with no ignored dist/ output.

Clean proof with Bun 1.4.0 and Node 24.7.0 on PATH:

• bun run audit
• bun run fmt:check
• bun run lint
• bun run typecheck
• bun run effect-tsgo:diagnostics — 59 files, 0 diagnostics
• bun run check
• bun run test — 14 files, 117 tests
• bun run check:target-conformance
• bun run artifacts
• bun run verify:artifacts
• bun run check:public-boundary
• bun run smoke:install
• /home/ericjuta/.local/bin/omp-reviewer --base origin/main --format json --time-budget 20m — no findings; patch correct at 0.87 confidence
• clean-output bun run eval:replay -- --suite packages/evals/src/fixtures/model-smoke.yaml --observations packages/evals/src/fixtures/synthetic-observations.yaml --output /tmp/askgina-esm-clean-eval.json — rebuilt all five packages and wrote the sanitized report

Artifact proof:

• Five package archives, five host archives, one skills candidate, and four bounded receipts were assembled and verified.
• Fresh Bun consumers exercised all five packed packages. A mandatory Node 24 consumer imported the exact packed SDK/contracts tarballs and resolved the representative stack frame to embedded TypeScript without raw source installed.
• Two uncached five-package vp pack builds produced the same 30 paths and aggregate path/content digest: 65ddc76ee95d077a387e7af5eab69a114324efd507de43d160b220e69ee4dba1.
• No generated dist output is tracked, and no package was published, tagged, released, deployed, installed as a skill, or submitted to an OpenAI portal.